Forum Home
Press F1
 
Thread ID: 117653 2011-04-27 22:05:00 Malware prob, security centre turns off Renegade (16270) Press F1
Post ID Timestamp Content User
1197890 2011-04-27 22:05:00 Got his PC here (Win7 HomePrem32), guy said he got drunk and went on "some dodgy sites" and had the old fake AV warning.

Seeing these on a weekly basis I just booted straight into safe mode and nuked with MBAM without checking to see which of the many variants it was. Noticed he had AVG9 on so I uninstalled and put MSE on. Now the fun starts. MSE doesn't start "MSE isn't monitoring your computer because the program's service stopped. You should restart it now." Starting it doesn't work. Also noticed the Security Centre isn't working. Start it in services and it turns itself back off after 10 seconds! Cleaned off some more crap with Spybot & SuperAntiSpyware but no go.

Any suggestions before I nuke it and format/reinstall?

MBAM & HijackThis logs:

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 12
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\2EOETFM3W2 (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\D1T2EUR7FZ (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Street-Ads (Adware.Adrotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Street-Ads (Adware.Adrotator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\$XNTUninstall643$ (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{B0E1C323-7403-4DEA-8F1D-B016B9B013B1} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\brumadeksgrm.brumadeksgrm.1.0 (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\brumadeksgrm.brumadeksgrm (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{B0E1C323-7403-4DEA-8F1D-B016B9B013B1} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Settings\{B0E1C323-7403-4DEA-8F1D-B016B9B013B1} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{B0E1C323-7403-4DEA-8F1D-B016B9B013B1} (Adware.AdRotator) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\D1T2EUR7FZ (Trojan.Downloader) -> Value: D1T2EUR7FZ -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\RunOnce\iJh01805gEbMm01805 (Trojan.Fakealert) -> Value: iJh01805gEbMm01805 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\bipro (Trojan.Agent.Gen) -> Value: bipro -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\Windows\$xntuninstall643$ (Adware.AdRotator) -> Quarantined and deleted successfully.

Files Infected:
c:\Users\<username>\AppData\Local\Temp\Rz0.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\programdata\ijh01805gebmm01805\ijh01805gebmm018 05.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
c:\Users\<username>\AppData\Local\Temp\a8C5A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Rrymea.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\<username>\favorites\free porn.url (Rogue.Link) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{35dc3473-a719-4d14-b7c1-fd326ca84a0c}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\$xntuninstall643$\apuninstall.exe (Adware.AdRotator) -> Quarantined and deleted successfully.
c:\Windows\$xntuninstall643$\qkflt.dll (Adware.AdRotator) -> Quarantined and deleted successfully.
c:\Windows\$xntuninstall643$\zrpt.xml (Adware.AdRotator) -> Quarantined and deleted successfully.



***HJT***
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:53:36 a.m., on 28/04/2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
E:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo!Xtra Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstan ce.dll
O3 - Toolbar: Yahoo!Xtra Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\RunOnce: [AvgUninstallURL] cmd.exe /c start www.avg.com BMAEEAQQAtAEEANAA4ADkAUgAtADkAVQBKAEsARgAtAEUASwBL ADMAWAA"&"inst=NwA3AC0ANAA0ADgANQA4ADgAOQA4ADYALQBUAEIAOQArA DIALQBGAEwAKwA5AC0AWABPADMANgArADEALQBGADkATQAxADA AQQArADEALQBYAE8AOQArADEA"&"prod=90"&"ver=9.0.894
O4 - HKLM\..\Policies\Explorer\Run: [pvfhhb] C:\Windows\system32\msexch40U.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - Winlogon Notify: hummopt - C:\Windows\system32\config\systemprofile\AppData\L ocal\hummopt.dll (file missing)

--
End of file - 5511 bytes
Renegade (16270)
1197891 2011-04-27 22:19:00 Boot into safe mode with networking - run Rkill (www.bleepingcomputer.com) - then run Combofix (www.bleepingcomputer.com) wainuitech (129)
1197892 2011-04-28 00:48:00 Hmmmm, both those are bluescreening
storport.sys + IRQL_NOT_LESS_EQUAL

Time to test ram & harddrive?
www.sevenforums.com
Renegade (16270)
1197893 2011-04-28 01:09:00 Could be RAM - but doubt it, As per the link you posted:


storport . sys is a Windows storage controller driver, not the true cause of this The malware by the looks of it has really done a number on the OS / Drivers .

Sometimes what you see is only the tip of the iceberg as the saying goes . Some infections are deeply embedded - and the only way to remove them is save any data, nuke the drive and reinstall .

IF those programs wont run in safe mode with networking, try straight safe mode . IF they still wont work - nuke the thing .

Race ya :p Doing one right now after cloning the drive to save the data , similar infection and the bloody thing simply wont leave no matter what I do, and its VERY badly damaged .
wainuitech (129)
1197894 2011-04-28 01:17:00 LOL, same in Safemode. Harddrive Sentinel can't report the drive status, and Seatools has a Fatal Error: Device Discovery. This is well done in by the looks of it.

Luckily the dude has absolutely no data on this, just uses it for webmail, Facebook, MSN & I guess occasional porn! Just need to backup IE favs and its ready to roll.
Renegade (16270)
1197895 2011-04-28 01:41:00 Just doing another one I collected this morning , has the XP antivirus malware.

Removed the main file from documents and settings -- then run combofix, and lookey what it found instantly ( attachment) :)

PS: the customer has trend micro Internet security :(
wainuitech (129)
1197896 2011-04-28 01:44:00 Put this on a bootable flash drive (support.kaspersky.com) if you have one then run it. It may also be a rootkit. Or if you can get into windows run it, after you get into windows

You can remove these from the hjt log

O4 - HKLM\..\RunOnce: [AvgUninstallURL] cmd.exe /c start www.avg.com BMAEEAQQAtAEEANAA4ADkAUgAtADkAVQBKAEsARgAtAEUASwBL ADMAWAA"&"inst=NwA3AC0ANAA0ADgANQA4ADgAOQA4ADYALQB
UAEIAOQArADIALQBGAEwAKwA5AC0AWABPADMANgArADEALQBGA DkATQAxADAAQQArADEALQBYAE8AOQArADEA"&"prod=90"&"ve r=9.0.894

O4 - HKLM\..\Policies\Explorer\Run: [pvfhhb] C:\Windows\system32\msexch40U.exe

O20 - Winlogon Notify: hummopt - C:\Windows\system32\config\systemprofile\AppData\L ocal\hummopt.dll (file missing)

If you cant get into the normal account and you've got another account, do this in the other account
Speedy Gonzales (78)
1197897 2011-04-28 02:01:00 LOL, same in Safemode . Harddrive Sentinel can't report the drive status, and Seatools has a Fatal Error: Device Discovery . This is well done in by the looks of it .

Use HDAT2 then, it boots from its own media so should work just fine .
Agent_24 (57)
1197898 2011-04-28 04:17:00 The bootable HDS works and reports drive ok.

TDSKiller found and cured a rootkit, but system is still flaky. Re-install time:banana
Renegade (16270)
1197899 2011-04-28 04:54:00 Get trojan remover run it then click on scan. The select all options under the utils menu. Then open a command prompt as admin type sfc /scannow

Save this as a reg file then run it

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\wscsvc]
"DisplayName"="@%SystemRoot%\\System32\\wscsvc.dll,-200"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00, 52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d ,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00 ,78,00,65,00,20,00,2d,00,\
6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65 ,00,72,00,76,00,69,00,63,\
00,65,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00 ,52,00,65,00,73,00,74,00,\
72,00,69,00,63,00,74,00,65,00,64,00,00,00
"Start"=dword:00000002
"Type"=dword:00000020
"Description"="@%SystemRoot%\\System32\\wscsvc.dll,-201"
"DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,57,00, 69,00,6e,00,\
4d,00,67,00,6d,00,74,00,00,00,00,00
"ObjectName"="NT AUTHORITY\\LocalService"
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,43,00,68,00,61,00,6e,00,67,00, 65,00,4e,\
00,6f,00,74,00,69,00,66,00,79,00,50,00,72,00,69,00 ,76,00,69,00,6c,00,65,00,\
67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65 ,00,72,00,73,00,6f,00,6e,\
00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00 ,6c,00,65,00,67,00,65,00,\
00,00,00,00
"DelayedAutoStart"=dword:00000001
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00, 00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00 ,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\wscsvc\Parameters]
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00, 52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00 ,6d,00,33,00,32,00,5c,00,\
77,00,73,00,63,00,73,00,76,00,63,00,2e,00,64,00,6c ,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\wscsvc\Security]
"Security"=hex:01,00,14,80,c8,00,00,00,d4,00,00,00,14,00,00, 00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01 ,00,00,00,00,00,01,00,00,\
00,00,02,00,98,00,06,00,00,00,00,00,14,00,fd,01,02 ,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00 ,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,9d,01,02,00,01,01,00,00,00 ,00,00,05,04,00,00,00,00,\
00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00 ,00,00,00,00,14,00,00,01,\
00,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,00,28 ,00,15,00,00,00,01,06,00,\
00,00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55 ,dc,f4,e2,0e,a7,8b,eb,ca,\
7b,42,13,56,01,01,00,00,00,00,00,05,12,00,00,00,01 ,01,00,00,00,00,00,05,12,\
00,00,00
Speedy Gonzales (78)
1 2